AGPL says you have to allow if you have a website to completely download of not just the code it runs but also all the dependent code that it runs, so not just itself but everything it touches. Without things like SPDX, the border is a bit fuzzy to the procurement people. If you run it on Solaris, do you have to provide a copy of Solaris?